vj% SrSSKJr SSKrSSKrSSKJr SSKJr SSK J r J r SSK J r SSKJrJrJrJr SS KJrJrJrJr SS KJr SS KJr \"1S k5rS rSrSr Sr!"SS5r""SS5r#SSjr$SSjr%SSjr&g)a@WorkOS sign-in for the hosted playground. Every request the app serves passes the login gate. A request carrying a live session cookie for the configured organization goes through; otherwise the gate redirects a browser to ``/login`` or refuses an API call with 401. A few paths are open without a session: the sign-in routes themselves, the health route the load balancer and the startup page poll, and the static assets, which are the app's code and carry no document data. Four routes come with the gate. ``/login`` sends the browser to WorkOS, ``/callback`` finishes the sign-in WorkOS sends back and sets the cookie, ``/logout`` clears the cookie and ends the WorkOS session, and ``/api/me`` tells the client who is signed in so it can offer sign-out. The sign-in itself, the organization check and the cookie all come from ``quber.playground.session``, which the wake function shares: a person who signs in while no task is running gets the same cookie from the function, and the gate here accepts it once the task is up. The gate is a pure ASGI middleware rather than a Starlette ``BaseHTTPMiddleware`` so the answer and batch streams pass through untouched. It checks the organization on every request, not only at sign-in, so a cookie issued under another organization, or before the setting changed, is refused like an expired one. ``install`` decides whether the sign-in is on. All four settings unset means the developer host, where the app runs open. All four set means the hosted playground. A partial set is a misconfiguration and is refused at startup, because the alternative is a hosted app that silently runs open. The gate is also where signed-in use is counted. Every request that passes with a valid session is one unit of activity, and ``ActivityMeter`` reports the count to CloudWatch once a minute when a namespace is configured. The hosted service's idle alarm watches that metric rather than the load balancer's request count, because a public hostname is never quiet: internet scanners reach the sign-in page every few minutes, and only a session tells a person apart from them. ) annotationsN)Optional) urlencode)FastAPIRequest)logger) HTMLResponse JSONResponseRedirectResponseResponse)ASGIAppReceiveScopeSend)session)PlaygroundSettings>/login/logout/healthz /callback)z/static/AuthenticatedRequests<z/static/qubera-mark-160.pngc6\rSrSrSrSSjrS SjrS SjrSrg) ActivityMeter>a Counts requests that carried a valid session and reports the count to CloudWatch once a minute. A minute with nothing to report is reported as zero, so the metric has a datapoint whenever a task is up; the alarm's missing-data rule covers the time nothing is up at all.cXlX lSUl[R"5Ul[R "URSSS9R5 g)Nrzactivity-meterT)targetnamedaemon) namespaceservicecount threadingLocklockThreadrunstart)selfr r!s 3/home/mande/repo/quber/src/quber/playground/auth.py__init__ActivityMeter.__init__DsA"  NN$ /?MSSUczUR U=RS- slSSS5 g!,(df  g=f)N)r%r")r)s r*recordActivityMeter.recordKs YY JJ!OJYYs, :cSSKnURS5n[R"[5 UR  UR Sso0lSSS5 URUR[SURS./WSS./S9 Mw!,(df  NC=f![a!n[R"SU5 SnAN9SnAff=f) Nr cloudwatchService)NameValueCount) MetricName Dimensionsr6Unit) Namespace MetricDatazactivity metric not sent: {})boto3clienttimesleepACTIVITY_INTERVAL_SECONDSr%r"put_metric_datar ACTIVITY_METRICr! Exceptionrwarning)r)r=r>r"excs r*r'ActivityMeter.runOsl+ JJ0 1$(JJ!z D&&"nn+:4= +U*V%*$+  '   D=sCC Ds#B2B B C )CC )r"r%r r!N)r strr!rHreturnNone)rIrJ) __name__ __module__ __qualname____firstlineno____doc__r+r0r'__static_attributes__r-r*rr>s? VDr-rcB\rSrSrSS.SSjjrSSjrSrg) LoginGategN)meterc4XlX lX0lX@lgN)appsecretorganization_idrU)r)rXrYrZrUs r*r+LoginGate.__init__hs . r-cV# USS:waURXU5IShvN gUSnU[;dUR[5(aURXU5IShvN g[ X5n[ R "URURURR[ R55nUbVURbURR5 XaRS05S'URXU5IShvN gURS5(a [SS0S S 9nOHURS S 5R!5nXH(aS U-OS-n [#S[%SU 05-SS 9nU"XU5IShvN gGN~GN=NN 7f)Ntypehttppathstateidentityz/api/detailzlogin requiredi status_code query_stringr-?z/login?next.)rX OPEN_PATHS startswith OPEN_PREFIXESrrverifyrYrZcookiesgetCOOKIErUr0 setdefaultr decoder r) r)scopereceivesendr_requestraresponsequeryrs r*__call__LoginGate.__call__usr =F "((540 0 0 V} : !?!?((540 0 0 %)>>$++t/C/CW__EXEXY`YgYgEhi  zz% !!#8@  Wb )* 5((540 0 0  ??7 # ##X/?$@cRHIInc299;EES5[r:F' Ivv>N4O(O]`aHut,,,) 1 1 1 -sHF)FAF)%F"&B6F)F%AURRS5S:H$)zgWhether to mark the cookie Secure: it is then sent back only over HTTPS, which is every hosted request.r|https)r~ro)rvs r*securers ??  2 3w >>r-c^ ^ URURURUR4n[ U5(dSSjnUR SUS/SS9 g[ U5(d [S5eSU5upEnm [R"XEUT S9m UR(a[URS 5OS nSSU 4S jjjnSSU 4S jjjn SU 4S jjn SSjn UR SUS/[SS9 UR SU S/SS9 UR SU S/SS9 UR SU S/SS9 UR[T XgS9 g)aPut the sign-in in front of ``app`` when settings ask for it. Returns whether the sign-in is on. Raises when the four settings are only partly set, so a hosted app never starts open by accident. ``/api/me`` is added either way, answering an empty object on the developer host. c0$rWrQrQr-r*me_openinstall..me_opensIr-z/api/meGETF)methodsinclude_in_schemazWORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_ORGANIZATION_ID and PLAYGROUND_SESSION_SECRET must be set together; the sign-in is on only when all four are present.c38# UHn[U5v M g7frW)rH).0vs r* install..s2J6a3q666s)api_key client_idrZsession_secretzquber-playgroundNcb>[[R"T[U5U[55$rW)r r login_pagerMARK_SRC)rvrhconfigs r*logininstall..logins%G..v|G7LdT\]^^r-c >[R"T[U5X[5nURb UR cH[ R"SUR5 [UR=(d SURS9$[UR SS9nURRS[R"UR[U5S95 U$)Nzsign-in not accepted: status {}rgrci/ set-cookier)rcomplete_sign_inrrtokenlocationrinfostatusr pager r~append cookie_headerr)rvcoder`outcomerwrs r*callbackinstall..callbacks**6<3H$W_` == G$4$4$< KK97>> J 2O O#G$4$4#F g.C.CGMMZ`ahZi.jkr-c>[R"TURR[R55n[ U5nU(a2UR (a![R"UR U5OSn[USS9nURRS[R"[U5S95 U$)N/rircrr) rsigned_identityrnrorprsid logout_urlr r~rclear_cookie_headerr)rvrabaserrwrYs r*logoutinstall..logouts**67??3F3Fw~~3VWG$;C ##HLL$7Z]#F< g.I.IQWX_Q`.abr-cV[URSS5nUbSUR0$0$)Nraemail)getattrr`r)rvras r*meinstall..mes./6w}}jRV/W,4,@(HbHr-r)rresponse_classrrr)rYrZrUT)rIdict[str, str]rW)rvrrh Optional[str]rIr )NN)rvrrrr`rrIr )rvrrIr )rvrrIr)workos_api_keyworkos_client_idworkos_organization_idrany add_api_routeall RuntimeErrorrWorkOSactivity_namespacerr add_middlewarerS)rXsettingsvaluesrrrrZrUrrrrrrYs @@r*installrsn !!'' F v;;  )WugQVW v;; V  3K62J/G ^^o^dF  & & h113EF  __ Ihw|glmk8eWPUVi%ERieWNy^ r-)rvrrIrH)rvrrIbool)rXrrrrIr)'rO __future__rr#r?typingr urllib.parserfastapirrlogururstarlette.responsesr r r r starlette.typesr rrrquber.playgroundrquber.settingsr frozensetrjrlrCrArrrSrrrrQr-r*rs}$L# "$VV99$- E F  ) (&D&DR$-$-NW? Br-